An active smishing and phishing campaign impersonating PagoPA is currently targeting Italian citizens. Italy’s National Cybersecurity Agency (ACN) has issued an official alert. Citizens and users of digital public services are firmly in the crosshairs.
Attackers are posing as PagoPA and the SEND notification service, sending SMS messages and emails containing fake administrative penalty notices. These messages include links to counterfeit websites designed to harvest personal and financial data.
How the PagoPA Smishing Campaign Works
The Attack Mechanism
The campaign relies on well-established social engineering techniques. SMS is the primary delivery channel, though traditional email is also used. In cases documented by CERT-AgID, attackers have also leveraged compromised Italian PEC (certified email) accounts.
The fraudulent message creates a sharp sense of urgency, threatening escalating penalties if payment is not made within a short window. It includes a link to a lookalike website that faithfully replicates the visual identity of PagoPA or SEND.
Once on the fake site, victims are prompted to submit:
- Personal and identity details
- Service login credentials
- Credit card or bank account numbers
- OTP and banking verification codes
Lures and Pretexts in Use
Attackers regularly rotate their cover stories. CERT-AgID has documented several active variants in 2026:
- Fake traffic fines delivered via SMS or compromised PEC accounts
- Fictitious TARI tax refunds requiring identity confirmation
- Fraudulent SEND notifications linking to data-harvesting pages
- Fake communications from the Polizia di Stato regarding road traffic violations
The fraud model, however, remains constant — only the lure changes. The end goal is always the theft of financial data.
Scale of the Threat and Historical Context
Figures Documented by CERT-AgID
The scale of the problem is substantial. CERT-AgID has tracked 1,874 campaigns abusing the PagoPA and SEND brands since 21 April 2025, distributing 14,279 indicators of compromise to Italian public administrations.
These figures point to a structural threat, not an isolated incident. The Italian public sector is a recurring and deliberate target.
Related Incidents in 2026
Recent documented cases paint a clear picture. In October 2026, compromised PEC accounts were used to distribute fake payment demands for traffic fines, complete with tight deadlines and threats of additional charges.
In September 2026, a campaign simulated a refund for excess TARI payments, walking victims through an identity verification process that ultimately demanded credit card details.
Separate campaigns in August and October 2026 impersonated both PagoPA and the Polizia di Stato, with the documented objective of stealing credentials and payment data. No evidence has emerged to suggest any compromise of PagoPA’s actual infrastructure.
Attribution: Threat Actor Unknown
No threat actor has been identified. Available evidence describes an opportunistic, financially motivated campaign. There is nothing linking this activity to known espionage groups or significant prior intrusions.
How to Defend Against PagoPA-Themed Smishing
Measures for Organizations and Public Administrations
Organizations must implement layered controls. Key operational priorities include:
- Phishing-resistant multi-factor authentication for email, PEC, payment systems, and privileged access
- PEC mailbox monitoring to detect compromises and anomalous outbound messages
- Secure email gateways with URL rewriting and time-of-click analysis
- Blocking of newly registered, lookalike, and high-risk domains
- Ingestion of CERT-AgID indicators into DNS, proxy, endpoint, and email controls
Activating a rapid takedown process is equally critical, involving registrars, hosting providers, telecoms operators, banks, and the national CSIRT.
Measures for Citizens and End Users
For end users, the rule is straightforward and must be communicated clearly. Any payment request received via SMS or email should be verified by opening the official app or manually typing the known address — never by following the link in the message.
Key warning signs to recognise include:
- Artificial urgency and threats of legal consequences
- Domains with names similar but not identical to official ones
- Requests for OTP codes or card details via SMS or email
- PEC messages from unusual senders or with unexpected content
It bears repeating: PagoPA never requests payment details via SMS. Any such communication is fraudulent.
Sources
- ACN – Smishing/phishing campaign impersonating PagoPA detected
- CERT-AgID – PagoPA phishing: new fine-themed campaigns distributed via compromised PEC
- AgID – PagoPA-themed phishing campaign
- PagoPA – What to know about security and online fraud attempts
Source: Original article
Campaigns like this PagoPA-themed operation highlight just how critical it is for public administrations and organizations to share threat intelligence on indicators of compromise in a timely and reliable manner. IsacChain enables the secure, certified exchange of this data between entities, while also supporting NIS2 compliance in an automated and fully traceable way. Thanks to blockchain-based verification, every shared indicator is immutable and auditable, guaranteeing the integrity of information even in active attack scenarios. Discover how IsacChain can help your organization at www.isacchain.com